Heap buffer overflow in Curl_ipv4_resolve_r due to incorrect buffer alignment and size calculation on AmigaOS

How it was found

Summary:

A heap-based buffer overflow exists in the AmigaOS-specific DNS resolution function Curl_ipv4_resolve_r located in lib/amigaos.c.

The function uses gethostbyname_r() with a fixed-size heap buffer (CURL_HOSTENT_SIZE) and performs incorrect pointer arithmetic when calculating the data buffer offset and size. This fails to account for structure alignment and padding requirements, which can result in the resolver writing past the allocated heap buffer.

The issue is specific to AmigaOS builds using the bsdsocket.library backend.

Impact

Impact Summary:

An attacker who can influence DNS responses or cause resolution of attacker- controlled hostnames may trigger heap memory corruption in curl or libcurl processes on AmigaOS.

Potential impacts include:

• Process crash (denial of service)
• Heap memory corruption
• Possible code execution depending on heap layout and mitigations

The impact is limited to AmigaOS platforms.